# alibaba/open-code-review

Fast, efficient, battle-tested at Alibaba's scale. Hybrid architecture code review tool: deterministic pipelines + LLM Agent, precise line-level comments, built-in multi-language ruleset (NPE, thread-safety, XSS, SQL injection), OpenAI & Anthropic compatible.

Repository: https://github.com/alibaba/open-code-review
Canonical: https://ross.abutalabs.com/products/open-code-review
Homepage: https://open-codereview.ai
Language: Go
License: Apache-2.0
License Family: permissive
Topics: agent, code-review, code-review-assistant, harness, repository-level-context, agent-skills
Last push: 2026-08-26T14:11:48+00:00

## Health v2 (maintenance only)
Score: 76/100 (v2, computed 2026-09-03T02:39:23.370411+00:00)
- activity 99, release rhythm 87, longevity 7
- inputs: {"age_days": 108, "days_push": 7, "days_rel": 6, "gap_med": 0.0, "n_releases_24m": 113}
- flags: young
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 21468, forks 1576 (observed 2026-08-28T04:11:31.738833+00:00)

## What it is
OpenCodeReview is an AI-powered code review CLI tool that combines deterministic analysis pipelines with an LLM Agent to produce precise line-level review comments. Originally Alibaba's internal AI code review assistant, it ships with built-in multi-language rulesets covering defects like NPE, thread-safety issues, XSS, and SQL injection, and works with OpenAI- and Anthropic-compatible models.

## Use cases
- automate code review on pull requests
- detect null pointer and thread-safety bugs before merge
- scan diffs for XSS and SQL injection vulnerabilities
- add AI-generated line-level review comments to a repository
- run LLM-based code review locally from the CLI
- enforce consistent multi-language review rulesets across teams

## When to choose
- you want battle-tested AI code review proven at large-enterprise scale
- you need deterministic rules plus LLM reasoning in one hybrid pipeline
- you want precise line-level comments rather than vague file-level feedback
- you use OpenAI- or Anthropic-compatible models and a Go/Node CLI workflow

## When to avoid
- you need fully offline review with no LLM API access
- you only want traditional static analysis without AI commentary
- your workflow requires deep IDE integration rather than CLI/agent-based review

## Facets
- artifact type: cli-tool
- maturity: active
- function: code-review, llm-inference, agent-framework, security, cli, developer-tools
- domain: developer-tools, version-control, security, artificial-intelligence, large-language-models
- platform: windows, cli, go
- tags: ai-code-review, line-level-comments, llm-agent, static-analysis, github-integration, multi-language, battle-tested, linux, macos, nodejs

## Member repositories
- alibaba/open-code-review (main) score 76

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:11:31.738833+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T16:58:06.046165+00:00, confidence not recorded.
  - readme: https://github.com/alibaba/open-code-review (fetched 2026-08-28T04:11:31.738833+00:00, sha 4404474f90d1)
  - homepage: https://open-codereview.ai (fetched 2026-08-29T07:56:36.412661+00:00, sha ac6199be7530)
- Data as of 2026-08-30T08:39:29.467469+00:00.